- NANOG - lists.nanog.org

Re: A Deep Dive on the Recent Widespread DNS Hijacking
by James Renken 04 Mar '19

04 Mar '19

On Feb 25, 2019, at 5:20 AM, Bill Woodcock <woody(a)pch.net> wrote: > We know that neither Comodo nor Let's Encrypt were DNSSEC validating before issuing certs. I’d like to clarify that Let’s Encrypt has always validated DNSSEC, dating to before we issued our first publicly trusted certificate in September 2015. -- James Renken (pronouns: he/him) Internet Security Research Group Let's Encrypt: A Free, Automated, and Open CA

2 1

AT&T or Cogent Assistance
by Cummings, Chris 03 Mar '19

03 Mar '19

Good Evening, Can anyone from AT&T or Cogent assist me? I cannot connect between two of my sites, and the issue appears to be either on AT&T’s network or between AT&T and Cogent according to traceroute. All Internet traffic at both sites appears to be functioning, other than this site to site connectivity: Traceroute from side A, source IP 64.179.178.34: FW-A# exec traceroute 12.166.160.250 traceroute to 12.166.160.250 (12.166.160.250), 32 hops max, 3 probe packets per hop, 84 byte packets 1 64.179.178.33 <static-33.64-179-178.vastbb.net> 2.297 ms 2.098 ms 1.849 ms 2 208.117.98.138 <host-138.208-117-98.vastbb.net> 1.590 ms 1.643 ms 2.012 ms 3 10.255.0.0 11.100 ms 19.099 ms 22.795 ms 4 216.16.3.155 18.779 ms 18.644 ms 18.694 ms 5 38.142.172.9 <be5043.rcr21.msp01.atlas.cogentco.com> 27.814 ms 27.903 ms 27.844 ms 6 154.54.24.34 <be2411.ccr41.ord01.atlas.cogentco.com> 33.590 ms 33.645 ms 33.625 ms 7 154.54.45.18 <be2765.ccr41.ord03.atlas.cogentco.com> 33.418 ms 33.639 ms 33.808 ms 8 154.54.12.86 <att.ord03.atlas.cogentco.com> 36.106 ms 35.741 ms 36.079 ms 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * Traceroute from side B, source IP 12.166.160.250: FW-B# exec traceroute 64.179.178.34 traceroute to 64.179.178.34 (64.179.178.34), 32 hops max, 3 probe packets per hop, 84 byte packets 1 12.166.160.249 0.148 ms 0.088 ms 0.082 ms 2 10.17.1.5 2.195 ms 2.281 ms 1.995 ms 3 10.17.0.5 4.179 ms 2.627 ms 3.879 ms 4 12.117.201.149 18.532 ms 18.482 ms 20.171 ms 5 12.122.158.170 87.847 ms * * 6 12.122.158.177 81.833 ms 86.028 ms 82.135 ms 7 12.122.5.229 <cr82.st0wa.ip.att.net> 88.562 ms 85.265 ms 84.468 ms 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * * 14 * * * 15 * * * Both IPs in question here are setup to respond to ICMP ping. Thanks in advance! /chris

1 0

Question about ISP billing procedures
by Daniel Rohan 02 Mar '19

02 Mar '19

Can anyone shed light on how ISPs handle missing samples when calculating p95s for monthly billing cycles? Do they fill null samples with zeros or leave them as null? I’m working on a billing sanity tool and want to make sure to cover my corner cases well. Thanks! Dan -- Thanks, Dan

9 8

2019 Program Committee Appointees
by L Sean Kennedy 01 Mar '19

01 Mar '19

Dear NANOG Community, Thanks for joining us in San Francisco and online for NANOG 75! I am excited to announce that 16 NANOG members accepted appointments to the Program Committee! There were 31 highly-qualified volunteers from the NANOG membership nominated for this year’s committee selection and it was a challenging exercise for the board to appoint a subset to serve this upcoming term. NANOG as an organization was founded by volunteers who set out to provide a high quality operator forum in North America. Despite the growth in NANOG’s programs, volunteers greatly outnumber professional staff and the volunteer-only Program Committee is responsible for soliciting, developing, and selecting all program content presented at NANOG meetings and other events. I personally thank each of the volunteers who were nominated for offering their time to NANOG and in early 2020 we hope to have them and other qualified candidates participating in our next appointment cycle to ensure appointment of a similar qualified and diverse cross-section of our community. Please join me in congratulating the PC members appointed. Tom Beecher, Jeff Bartig, Jason Bothe, Adam Davenport, Steve Feldman, Cat Gurinsky, Greg Hankins, Alex Latzko, Hossein Lotfi, Steve Meuse, Nagendra Kumar Nainar, Kat Parsons, Rekha Rawat, Brad Raymo, Matthew Ringel, and Anna Valsami Please thank and recognize the contributions of Christina Chu, Philippe Couture, Mohit Lad, Ryan Landry, Jeff Ringwelski, Krassimir Tzvetanov, Chris Woodfield, and Ryan Woolley for their service to NANOG on the Program Committee. In the coming weeks, the new Program Committee will hold its first meeting to develop content for NANOG 76 and select its leadership. The NANOG board is excited to see what the new PC will present to our community at that meeting and hope to see all of you in Washington DC in June! Thanks, Sean (for the NANOG Board of Directors)

1 0

Weekly Routing Table Report
by cscora＠apnic.net 01 Mar '19

01 Mar '19

This is an automated weekly mailing describing the state of the Internet Routing Table as seen from APNIC's router in Japan. The posting is sent to APOPS, NANOG, AfNOG, SANOG, PacNOG, SAFNOG TZNOG, MENOG, BJNOG, SDNOG, CMNOG, LACNOG and the RIPE Routing WG. Daily listings are sent to bgp-stats(a)lists.apnic.net For historical data, please see http://thyme.rand.apnic.net. If you have any comments please contact Philip Smith <pfsinoz(a)gmail.com>. Routing Table Report 04:00 +10GMT Sat 02 Mar, 2019 Report Website: http://thyme.rand.apnic.net Detailed Analysis: http://thyme.rand.apnic.net/current/ Analysis Summary ---------------- BGP routing table entries examined: 738919 Prefixes after maximum aggregation (per Origin AS): 285184 Deaggregation factor: 2.59 Unique aggregates announced (without unneeded subnets): 355932 Total ASes present in the Internet Routing Table: 63421 Prefixes per ASN: 11.65 Origin-only ASes present in the Internet Routing Table: 54634 Origin ASes announcing only one prefix: 23613 Transit ASes present in the Internet Routing Table: 8787 Transit-only ASes present in the Internet Routing Table: 273 Average AS path length visible in the Internet Routing Table: 4.2 Max AS path length visible: 32 Max AS path prepend of ASN ( 16327) 25 Prefixes from unregistered ASNs in the Routing Table: 28 Number of instances of unregistered ASNs: 31 Number of 32-bit ASNs allocated by the RIRs: 25985 Number of 32-bit ASNs visible in the Routing Table: 21159 Prefixes from 32-bit ASNs in the Routing Table: 92373 Number of bogon 32-bit ASNs visible in the Routing Table: 26 Special use prefixes present in the Routing Table: 1 Prefixes being announced from unallocated address space: 250 Number of addresses announced to Internet: 2843232227 Equivalent to 169 /8s, 120 /16s and 71 /24s Percentage of available address space announced: 76.8 Percentage of allocated address space announced: 76.8 Percentage of available address space allocated: 100.0 Percentage of address space in use by end-sites: 99.2 Total number of prefixes smaller than registry allocations: 247641 APNIC Region Analysis Summary ----------------------------- Prefixes being announced by APNIC Region ASes: 200962 Total APNIC prefixes after maximum aggregation: 57781 APNIC Deaggregation factor: 3.48 Prefixes being announced from the APNIC address blocks: 197911 Unique aggregates announced from the APNIC address blocks: 81748 APNIC Region origin ASes present in the Internet Routing Table: 9492 APNIC Prefixes per ASN: 20.85 APNIC Region origin ASes announcing only one prefix: 2667 APNIC Region transit ASes present in the Internet Routing Table: 1411 Average APNIC Region AS path length visible: 4.1 Max APNIC Region AS path length visible: 26 Number of APNIC region 32-bit ASNs visible in the Routing Table: 4489 Number of APNIC addresses announced to Internet: 769995650 Equivalent to 45 /8s, 229 /16s and 51 /24s APNIC AS Blocks 4608-4864, 7467-7722, 9216-10239, 17408-18431 (pre-ERX allocations) 23552-24575, 37888-38911, 45056-46079, 55296-56319, 58368-59391, 63488-64098, 64297-64395, 131072-139577 APNIC Address Blocks 1/8, 14/8, 27/8, 36/8, 39/8, 42/8, 43/8, 49/8, 58/8, 59/8, 60/8, 61/8, 101/8, 103/8, 106/8, 110/8, 111/8, 112/8, 113/8, 114/8, 115/8, 116/8, 117/8, 118/8, 119/8, 120/8, 121/8, 122/8, 123/8, 124/8, 125/8, 126/8, 133/8, 150/8, 153/8, 163/8, 171/8, 175/8, 180/8, 182/8, 183/8, 202/8, 203/8, 210/8, 211/8, 218/8, 219/8, 220/8, 221/8, 222/8, 223/8, ARIN Region Analysis Summary ---------------------------- Prefixes being announced by ARIN Region ASes: 218584 Total ARIN prefixes after maximum aggregation: 103553 ARIN Deaggregation factor: 2.11 Prefixes being announced from the ARIN address blocks: 217591 Unique aggregates announced from the ARIN address blocks: 104294 ARIN Region origin ASes present in the Internet Routing Table: 18393 ARIN Prefixes per ASN: 11.83 ARIN Region origin ASes announcing only one prefix: 6848 ARIN Region transit ASes present in the Internet Routing Table: 1856 Average ARIN Region AS path length visible: 3.8 Max ARIN Region AS path length visible: 24 Number of ARIN region 32-bit ASNs visible in the Routing Table: 2592 Number of ARIN addresses announced to Internet: 1079214496 Equivalent to 64 /8s, 83 /16s and 129 /24s ARIN AS Blocks 1-1876, 1902-2042, 2044-2046, 2048-2106 (pre-ERX allocations) 2138-2584, 2615-2772, 2823-2829, 2880-3153 3354-4607, 4865-5119, 5632-6655, 6912-7466 7723-8191, 10240-12287, 13312-15359, 16384-17407 18432-20479, 21504-23551, 25600-26591, 26624-27647, 29696-30719, 31744-33791 35840-36863, 39936-40959, 46080-47103 53248-55295, 62464-63487, 64198-64296, 393216-399260 ARIN Address Blocks 3/8, 4/8, 6/8, 7/8, 8/8, 9/8, 11/8, 12/8, 13/8, 15/8, 16/8, 17/8, 18/8, 19/8, 20/8, 21/8, 22/8, 23/8, 24/8, 26/8, 28/8, 29/8, 30/8, 32/8, 33/8, 34/8, 35/8, 38/8, 40/8, 44/8, 45/8, 47/8, 48/8, 50/8, 52/8, 53/8, 54/8, 55/8, 56/8, 57/8, 63/8, 64/8, 65/8, 66/8, 67/8, 68/8, 69/8, 70/8, 71/8, 72/8, 73/8, 74/8, 75/8, 76/8, 96/8, 97/8, 98/8, 99/8, 100/8, 104/8, 107/8, 108/8, 128/8, 129/8, 130/8, 131/8, 132/8, 134/8, 135/8, 136/8, 137/8, 138/8, 139/8, 140/8, 142/8, 143/8, 144/8, 146/8, 147/8, 148/8, 149/8, 152/8, 155/8, 156/8, 157/8, 158/8, 159/8, 160/8, 161/8, 162/8, 164/8, 165/8, 166/8, 167/8, 168/8, 169/8, 170/8, 172/8, 173/8, 174/8, 184/8, 192/8, 198/8, 199/8, 204/8, 205/8, 206/8, 207/8, 208/8, 209/8, 214/8, 215/8, 216/8, RIPE Region Analysis Summary ---------------------------- Prefixes being announced by RIPE Region ASes: 203010 Total RIPE prefixes after maximum aggregation: 96936 RIPE Deaggregation factor: 2.09 Prefixes being announced from the RIPE address blocks: 199408 Unique aggregates announced from the RIPE address blocks: 118435 RIPE Region origin ASes present in the Internet Routing Table: 25858 RIPE Prefixes per ASN: 7.71 RIPE Region origin ASes announcing only one prefix: 11480 RIPE Region transit ASes present in the Internet Routing Table: 3630 Average RIPE Region AS path length visible: 4.4 Max RIPE Region AS path length visible: 28 Number of RIPE region 32-bit ASNs visible in the Routing Table: 7871 Number of RIPE addresses announced to Internet: 717032640 Equivalent to 42 /8s, 189 /16s and 12 /24s RIPE AS Blocks 1877-1901, 2043, 2047, 2107-2136, 2585-2614 (pre-ERX allocations) 2773-2822, 2830-2879, 3154-3353, 5377-5631 6656-6911, 8192-9215, 12288-13311, 15360-16383 20480-21503, 24576-25599, 28672-29695 30720-31743, 33792-35839, 38912-39935 40960-45055, 47104-52223, 56320-58367 59392-61439, 61952-62463, 64396-64495 196608-210331 RIPE Address Blocks 2/8, 5/8, 25/8, 31/8, 37/8, 46/8, 51/8, 62/8, 77/8, 78/8, 79/8, 80/8, 81/8, 82/8, 83/8, 84/8, 85/8, 86/8, 87/8, 88/8, 89/8, 90/8, 91/8, 92/8, 93/8, 94/8, 95/8, 109/8, 141/8, 145/8, 151/8, 176/8, 178/8, 185/8, 188/8, 193/8, 194/8, 195/8, 212/8, 213/8, 217/8, LACNIC Region Analysis Summary ------------------------------ Prefixes being announced by LACNIC Region ASes: 95662 Total LACNIC prefixes after maximum aggregation: 22643 LACNIC Deaggregation factor: 4.22 Prefixes being announced from the LACNIC address blocks: 97031 Unique aggregates announced from the LACNIC address blocks: 42029 LACNIC Region origin ASes present in the Internet Routing Table: 8133 LACNIC Prefixes per ASN: 11.93 LACNIC Region origin ASes announcing only one prefix: 2188 LACNIC Region transit ASes present in the Internet Routing Table: 1529 Average LACNIC Region AS path length visible: 5.0 Max LACNIC Region AS path length visible: 32 Number of LACNIC region 32-bit ASNs visible in the Routing Table: 5681 Number of LACNIC addresses announced to Internet: 173345536 Equivalent to 10 /8s, 85 /16s and 11 /24s LACNIC AS Blocks 26592-26623, 27648-28671, 52224-53247, 61440-61951, 64099-64197, 262144-270748 + ERX transfers LACNIC Address Blocks 177/8, 179/8, 181/8, 186/8, 187/8, 189/8, 190/8, 191/8, 200/8, 201/8, AfriNIC Region Analysis Summary ------------------------------- Prefixes being announced by AfriNIC Region ASes: 20672 Total AfriNIC prefixes after maximum aggregation: 4249 AfriNIC Deaggregation factor: 4.87 Prefixes being announced from the AfriNIC address blocks: 26728 Unique aggregates announced from the AfriNIC address blocks: 9203 AfriNIC Region origin ASes present in the Internet Routing Table: 1253 AfriNIC Prefixes per ASN: 21.33 AfriNIC Region origin ASes announcing only one prefix: 430 AfriNIC Region transit ASes present in the Internet Routing Table: 252 Average AfriNIC Region AS path length visible: 4.4 Max AfriNIC Region AS path length visible: 21 Number of AfriNIC region 32-bit ASNs visible in the Routing Table: 526 Number of AfriNIC addresses announced to Internet: 103380224 Equivalent to 6 /8s, 41 /16s and 117 /24s AfriNIC AS Blocks 36864-37887, 327680-328703 & ERX transfers AfriNIC Address Blocks 41/8, 102/8, 105/8, 154/8, 196/8, 197/8, APNIC Region per AS prefix count summary ---------------------------------------- ASN No of nets /20 equiv MaxAgg Description 7545 4662 542 545 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4656 4192 74 ERX-CERNET-BKB China Education and Rese 7552 3096 1241 50 VIETEL-AS-AP Viettel Group, VN 45899 3044 1737 111 VNPT-AS-VN VNPT Corp, VN 4766 2813 11125 769 KIXS-AS-KR Korea Telecom, KR 9829 2752 1496 552 BSNL-NIB National Internet Backbone, IN 9808 2429 8699 26 CMNET-GD Guangdong Mobile Communication 9394 2345 4906 29 CTTNET China TieTong Telecommunications 4755 2146 422 180 TATACOMM-AS TATA Communications formerl 17974 2009 968 50 TELKOMNET-AS2-AP PT Telekomunikasi Indo Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-APNIC ARIN Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 6327 3611 1326 93 SHAW - Shaw Communications Inc., CA 11492 3524 228 608 CABLEONE - CABLE ONE, INC., US 22773 3306 2977 165 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 16509 2501 5370 1060 AMAZON-02 - Amazon.com, Inc., US 16625 2282 1268 1750 AKAMAI-AS - Akamai Technologies, Inc., 20115 2147 2739 544 CHARTER-20115 - Charter Communications, 18566 2123 405 108 MEGAPATH5-US - MegaPath Corporation, US 30036 2115 351 192 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom 5650 2091 3074 1462 FRONTIER-FRTR - Frontier Communications 209 2081 5094 583 CENTURYLINK-US-LEGACY-QWEST - CenturyLi Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-ARIN RIPE Region per AS prefix count summary --------------------------------------- ASN No of nets /20 equiv MaxAgg Description 12479 5371 1626 137 UNI2-AS, ES 39891 3778 203 20 ALJAWWALSTC-AS, SA 8551 3035 378 44 BEZEQ-INTERNATIONAL-AS Bezeqint Interne 20940 2634 545 1911 AKAMAI-ASN1, US 12389 2226 2221 637 ROSTELECOM-AS, RU 34984 2061 341 537 TELLCOM-AS, TR 9121 1681 1692 18 TTNET, TR 13188 1604 100 46 TRIOLAN, UA 9009 1343 145 746 M247, GB 8402 1305 545 15 CORBINA-AS OJSC "Vimpelcom", RU Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-RIPE LACNIC Region per AS prefix count summary ----------------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5587 3331 591 Uninet S.A. de C.V., MX 10620 2749 412 1054 Telmex Colombia S.A., CO 11830 2702 384 34 Instituto Costarricense de Electricidad 6503 1507 433 54 Axtel, S.A.B. de C.V., MX 7303 1430 961 231 Telecom Argentina S.A., AR 28573 1301 2246 186 CLARO S.A., BR 6147 1270 377 28 Telefonica del Peru S.A.A., PE 3816 1022 506 114 COLOMBIA TELECOMUNICACIONES S.A. ESP, C 11172 931 144 66 Alestra, S. de R.L. de C.V., MX 13999 929 517 243 Mega Cable, S.A. de C.V., MX Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-LACNIC AfriNIC Region per AS prefix count summary ------------------------------------------ ASN No of nets /20 equiv MaxAgg Description 24863 1202 393 21 LINKdotNET-AS, EG 37611 929 107 9 Afrihost, ZA 24835 848 636 22 RAYA-AS, EG 36903 827 416 125 MT-MPLS, MA 36992 811 1534 59 ETISALAT-MISR, EG 8452 689 1731 20 TE-AS TE-AS, EG 29571 484 70 13 ORANGE-COTE-IVOIRE, CI 37492 470 470 57 ORANGE-, TN 15399 429 45 11 WANANCHI-, KE 37342 420 32 1 MOVITEL, MZ Complete listing at http://thyme.rand.apnic.net/current/data-ASnet-AFRINIC Global Per AS prefix count summary ---------------------------------- ASN No of nets /20 equiv MaxAgg Description 8151 5587 3331 591 Uninet S.A. de C.V., MX 12479 5371 1626 137 UNI2-AS, ES 7545 4662 542 545 TPG-INTERNET-AP TPG Telecom Limited, AU 4538 4656 4192 74 ERX-CERNET-BKB China Education and Rese 39891 3778 203 20 ALJAWWALSTC-AS, SA 6327 3611 1326 93 SHAW - Shaw Communications Inc., CA 11492 3524 228 608 CABLEONE - CABLE ONE, INC., US 22773 3306 2977 165 ASN-CXA-ALL-CCI-22773-RDC - Cox Communi 7552 3096 1241 50 VIETEL-AS-AP Viettel Group, VN 45899 3044 1737 111 VNPT-AS-VN VNPT Corp, VN Complete listing at http://thyme.rand.apnic.net/current/data-ASnet Global Per AS Maximum Aggr summary ---------------------------------- ASN No of nets Net Savings Description 12479 5371 5234 UNI2-AS, ES 4538 4656 4582 ERX-CERNET-BKB China Education and Research Net 7545 4662 4117 TPG-INTERNET-AP TPG Telecom Limited, AU 39891 3778 3758 ALJAWWALSTC-AS, SA 6327 3611 3518 SHAW - Shaw Communications Inc., CA 22773 3306 3141 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 7552 3096 3046 VIETEL-AS-AP Viettel Group, VN 8551 3035 2991 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 45899 3044 2933 VNPT-AS-VN VNPT Corp, VN 11492 3524 2916 CABLEONE - CABLE ONE, INC., US Complete listing at http://thyme.rand.apnic.net/current/data-CIDRnet List of Unregistered Origin ASNs (Global) ----------------------------------------- Bad AS Designation Network Transit AS Description 230105 UNALLOCATED 38.110.79.0/24 23015 CMC180-TOR-AS - Cambridge Merc 266842 UNALLOCATED 45.238.156.0/22 265680 HNTELCO S.A, HN 65550 DOCUMENT 81.8.34.0/24 15924 BORUSANTELEKOM-AS, TR 65550 DOCUMENT 81.8.35.0/24 15924 BORUSANTELEKOM-AS, TR 1358592 UNALLOCATED 103.134.14.0/23 63956 COLO-AS-AP Colocation Australi 1358592 UNALLOCATED 103.134.15.0/24 63956 COLO-AS-AP Colocation Australi 65549 DOCUMENT 117.239.163.0/24 65544 UNKNOWN 224413 UNALLOCATED 131.221.136.0/24 264413 Conecta Telecom Ltda, BR 64339 UNALLOCATED 143.0.108.0/22 18747 IFX18747 - IFX Corporation, US 64355 UNALLOCATED 156.40.196.0/24 30387 NIH-NET-NCCS - National Instit Complete listing at http://thyme.rand.apnic.net/current/data-badAS Prefixes from private and non-routed address space (Global) ----------------------------------------------------------- Prefix Origin AS Description 198.18.1.19/32 7497 CSTNET-AS-AP Computer Network Information Cente Complete listing at http://thyme.rand.apnic.net/current/data-dsua Advertised Unallocated Addresses -------------------------------- Network Origin AS Description 27.100.7.0/24 56096 UNKNOWN 27.126.156.0/22 55827 UNKNOWN 27.126.156.0/23 55827 UNKNOWN 27.126.158.0/23 55827 UNKNOWN 41.76.136.0/22 37500 -Reserved AS-, ZZ 41.76.140.0/22 37500 -Reserved AS-, ZZ 41.78.92.0/22 14988 BTC-GATE1, BW 41.78.180.0/23 37265 -Reserved AS-, ZZ 41.220.48.0/20 36900 -Reserved AS-, ZZ 43.255.80.0/24 36351 SOFTLAYER - SoftLayer Technologies Inc., US Complete listing at http://thyme.rand.apnic.net/current/data-add-IANA Number of prefixes announced per prefix length (Global) ------------------------------------------------------- /1:0 /2:0 /3:0 /4:0 /5:0 /6:0 /7:0 /8:12 /9:10 /10:36 /11:100 /12:291 /13:567 /14:1134 /15:1907 /16:13363 /17:7914 /18:13889 /19:25651 /20:39785 /21:46161 /22:92355 /23:75415 /24:417393 /25:956 /26:842 /27:892 /28:27 /29:7 /30:15 /31:0 /32:197 Advertised prefixes smaller than registry allocations ----------------------------------------------------- ASN No of nets Total ann. Description 12479 4251 5371 UNI2-AS, ES 6327 3383 3611 SHAW - Shaw Communications Inc., CA 39891 2946 3778 ALJAWWALSTC-AS, SA 11492 2771 3524 CABLEONE - CABLE ONE, INC., US 22773 2546 3306 ASN-CXA-ALL-CCI-22773-RDC - Cox Communications 8551 2490 3035 BEZEQ-INTERNATIONAL-AS Bezeqint Internet Backbo 11830 2047 2702 Instituto Costarricense de Electricidad y Telec 18566 2018 2123 MEGAPATH5-US - MegaPath Corporation, US 30036 1862 2115 MEDIACOM-ENTERPRISE-BUSINESS - Mediacom Communi 5650 1761 2091 FRONTIER-FRTR - Frontier Communications of Amer Complete listing at http://thyme.rand.apnic.net/current/data-sXXas-nos Number of /24s announced per /8 block (Global) ---------------------------------------------- 1:1607 2:890 4:22 5:2778 6:45 7:1 8:1179 12:1858 13:313 14:1914 15:39 16:4 17:226 18:58 20:49 23:2577 24:2522 25:2 27:2544 31:2071 32:94 35:36 36:834 37:3029 38:1692 39:295 40:121 41:3158 42:745 43:2003 44:144 45:6815 46:3228 47:250 49:1365 50:1095 51:322 52:1025 54:289 55:1 56:6 57:40 58:1708 59:1073 60:501 61:2058 62:1988 63:1800 64:4994 65:2189 66:4824 67:2701 68:1165 69:3545 70:1326 71:601 72:2383 74:2759 75:516 76:546 77:1710 78:1760 79:2319 80:1686 81:1448 82:1128 83:865 84:1098 85:2205 86:547 87:1549 88:1027 89:2429 90:217 91:6579 92:1273 93:2480 94:2521 95:3230 96:918 97:346 98:945 99:206 100:88 101:1153 102:422 103:20142 104:3508 105:248 106:885 107:1755 108:700 109:3482 110:1631 111:1876 112:1410 113:1406 114:1135 115:1719 116:1706 117:1873 118:2144 119:1624 120:1019 121:1032 122:2284 123:1643 124:1455 125:1962 128:1251 129:831 130:526 131:1627 132:731 133:218 134:1051 135:242 136:556 137:711 138:2018 139:846 140:575 141:840 142:795 143:1045 144:838 145:510 146:1262 147:792 148:1692 149:797 150:780 151:1010 152:1017 153:323 154:2618 155:867 156:1738 157:923 158:669 159:1924 160:1513 161:917 162:2674 163:792 164:1131 165:1577 166:428 167:1395 168:3276 169:870 170:4013 171:562 172:1104 173:2185 174:1017 175:896 176:2315 177:3994 178:2540 179:1334 180:2100 181:2406 182:2698 183:1068 184:1168 185:14814 186:3767 187:2424 188:2908 189:1967 190:8357 191:1407 192:10047 193:6588 194:5384 195:4055 196:2979 197:1640 198:5798 199:5979 200:7196 201:5068 202:10186 203:10197 204:4613 205:2972 206:3239 207:3283 208:3974 209:4232 210:3930 211:1991 212:3062 213:2903 214:1086 215:54 216:5968 217:2210 218:920 219:581 220:1869 221:966 222:998 223:1434 End of report

1 0

RE: A Deep Dive on the Recent Widespread DNS Hijacking
by Montgomery, Douglas (Fed) 27 Feb '19

27 Feb '19

You might have missed reading the very article you cite. "Woodcock said PCH’s reliance on DNSSEC almost completely blocked that attack, but that it managed to snare email credentials for two employees who were traveling at the time. .... Aside from that, DNSSEC saved us from being really, thoroughly owned.” Or maybe ACME .. https://tools.ietf.org/html/draft-ietf-acme-acme-12#section-11.2 "It is therefore RECOMMENDED that ACME-based CAs make all DNS queries via DNSSEC-validating stub or recursive resolvers. This provides additional protection to domains which choose to make use of DNSSEC.” I am not sure how many of the domains listed as being hijacked are DNSSEC signed, but it seems if they were, and had a reasonable long TTL on a DS record at their parent, many if not most of these could have been prevented/detected. ICANN seems to think that is the case: ICANN Calls for Full DNSSEC Deployment https://www.icann.org/news/announcement-2019-02-22-en Of course, DNSSEC is often blamed for not protecting those who did not deploy/use it. Not sure what can be said about that line of reasoning. Dougm -- Doug Montgomery, Manager Internet & Scalable Systems Research @ NIST ============ Date: Sat, 23 Feb 2019 12:13:41 -0700 From: "Keith Medcalf" <kmedcalf(a)dessus.com> To: "nanog(a)nanog.org" <nanog(a)nanog.org> Subject: RE: A Deep Dive on the Recent Widespread DNS Hijacking Attacks Message-ID: <6e31d305aee69c4d85116e6a81d0c91d(a)mail.dessus.com> Content-Type: text/plain; charset="us-ascii" On Saturday, 23 February, 2019 10:03, Stephane Bortzmeyer wrote: >Very good article, very detailed, with a lot of technical precisions, >about the recent domain name hijackings (not using the DNS, just good >old hijackings at registrar or hoster). >https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dn… So in other words this was just an old school script kiddie taking advantage of DNS registrars, the only difference being this was a whole whack of script kiddies acting in concert directed by a not-quite-so-stupid script kiddie, with some "modernz" thrown in for good measure. (Sounds like an NSA operation to me -- and the targets perfectly match those that the NSA would choose -- plus some good old misdirection just for the jollies of it) The second takeaway being that DNSSEC is useless in preventing such an occurrence because the script kiddies can merely turn it off at the same time as they redirect DNS. However, having DNSSEC can protect you from incompetent script-kiddies. It can also give you a false sense of security. Did I miss anything? --- The fact that there's a Highway to Hell but only a Stairway to Heaven says a lot about anticipated traffic volume.

35 79

AWS - amzn-noc-contact
by Luiz Rosas 27 Feb '19

27 Feb '19

Hi, Can someone with amzn-noc contact me off list regarding AWS-ZOOMVIDEOCOMMUNICATIONS. Thx Luiz Luiz Rosas Sr. Network Engineer Race Communications Phone: +1 415-376-3327 luiz.rosas(a)race.com / www.race.com

1 0

Re: A Deep Dive on the Recent Widespread DNS Hijacking
by James Renken 26 Feb '19

26 Feb '19

On Feb 25, 2019, at 1:16 PM, Hank Nussbacher <hank(a)efes.iucc.ac.il> wrote: > Yes if an attacker pwned the DNS then game over no matter what. I go > under the assumption that the attacker was not able to take over the DNS > system but rather other things along the way, in which case CAA should > be of some assistance. I’m excited about a proposed CAA extension (https://tools.ietf.org/html/draft-ietf-acme-caa-06) that would allow domain owners to restrict issuance to a particular ACME account and a particular validation method. This could provide stronger protection against most attacks short of a registry or registrar hijack. It’s implemented in Let’s Encrypt's staging environment, and I hope it’s able to move forward. -- James Renken (pronouns: he/him) Internet Security Research Group Let's Encrypt: A Free, Automated, and Open CA

1 0

Looking for a digitalocean contact with clue.
by Marc Runkel 26 Feb '19

26 Feb '19

Sorry for the noise, Can anyone in digitalocean contact me off-list. I'm having what I believe to be a networking issue with three new droplets that doesn't appear on older droplets out of the Frankfurt datacenter and I can't seem to break through level 1 support. Would be appreciated. Marc Runkel

1 0

A Deep Dive on the Recent Widespread DNS Hijacking Attacks
by Stephane Bortzmeyer 23 Feb '19

23 Feb '19

Very good article, very detailed, with a lot of technical precisions, about the recent domain name hijackings (not using the DNS, just good old hijackings at registrar or hoster). https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dn…

3 2